Glossary
Windows LAPS
Windows Local Administrator Password Solution: a built-in feature that gives each device a unique, rotating local admin password stored in AD or Entra ID.
Windows LAPS (Local Administrator Password Solution) is a feature built into Windows 10, Windows 11 and Windows Server 2019 and later since the April 2023 updates. It sets a random, unique password for a local administrator account on each device, rotates it on a schedule or after use, and backs it up to Active Directory or Microsoft Entra ID, where only authorised groups can read it.
It breaks the most common lateral movement technique on Windows networks: reusing one local administrator password or hash across many machines. In Active Directory it can also encrypt the stored password, keep a password history and manage the DSRM password on domain controllers. It replaces the older, separately installed Microsoft LAPS.
See the Windows LAPS deployment guide.